Fix EZP-20322: Specify csrf use in REST for use with session based auth

Review needed in rst and xsd doc!

As for the .html file:
- Why is the html generated with different class names on code examples in my case? (docutils: v0.11, pygments v1.6)